Inside Assurance Toolkit #06 — Risk Register

A useful risk register helps a team make a decision about exposure, ownership and response. A list of risk labels becomes much more useful when the reasoning and uncertainty behind each entry are visible.

This original Inside Assurance workbook contains a blank register, a separate fictional worked example and a guide. It connects an objective with a cause, risk event, consequence, assessment, control evidence, owner and treatment.

Describe the event before assigning a number

In a fictional chilled-food operation, an entry might state that a temperature excursion is not detected in time because monitoring or response fails, potentially leading to product loss or unsafe release. The objective is to deliver products within the organisation’s approved conditions.

That statement gives the discussion a direction. “Operational risk: high” does not tell the reader which event needs attention or which response might help. Use entity-specific criteria and qualified technical judgment; the example does not prescribe food-safety limits.

Keep inherent and current residual exposure separate

The workbook provides likelihood and severity inputs for an inherent assessment and a separate current residual assessment. Record what each assessment means, its horizon and its evidence.

Existing controls may affect the current exposure, but a control name is not evidence that it works. A new alarm response, supplier or release procedure that is still being planned should not automatically reduce the current residual rating. Record a future treatment as an action and reassess when implementation and relevant evidence support it.

The residual index shows Basis needed when the control-evidence or assessment-basis field is blank. Filling those fields makes the reasoning inspectable; it does not verify the reasoning.

Treat the index as an aid to discussion

The teaching scale uses whole numbers from 1 to 5. Likelihood multiplied by severity produces a simple ordinal prioritisation index. The anchors are illustrative and need calibration before real use.

An index is not a probability, expected financial loss or percentage of control effectiveness. Two different likelihood-and-severity combinations can have the same product and need different responses. Do not sum the indices to claim a measured total exposure.

The worked examples are hypothetical. They illustrate how to document a judgment and how to leave a current residual assessment unknown when evidence is missing.

Give the response an owner and a review point

The register separates the risk owner from the person assigned to implement an action. It also records an action due date, status and last risk review.

The editable As-of date drives the days-overdue calculation. Update it before a review. A Closed label is an input, so validate the evidence supporting closure; the workbook does not certify that a risk has been resolved.

Try one entry

Choose a fictional process you understand. Describe its objective, cause, event and consequence. Explain the inherent assessment, identify existing controls and their evidence, and decide whether you can support a current residual assessment. Then record one response, an accountable owner and a review point.

A useful register preserves the question that still needs an answer as clearly as the action already agreed.

Beyond the numbers. Inside the business.